qiling icon indicating copy to clipboard operation
qiling copied to clipboard

`mmap_address` too high for mips

Open wtdcode opened this issue 1 year ago • 2 comments

Qiling uses 0x90000000 for linux mmap base address:

https://github.com/qilingframework/qiling/blob/b3293e131c38202c252d0dea34819a7f4026dd0e/qiling/profiles/linux.ql#L21

According to mips memory layout: https://training.mips.com/basic_mips/PDF/Memory_Map.pdf

0x90000000 is reserved for kseg0, which userspace programs shouldn't use. Previously, Unicorn included a dirty hack to support this and we are going to remove this in https://github.com/unicorn-engine/unicorn/pull/1746

Therefore, it's essential to change the mmap_address in profiles to a lower address, say 0x1000000 (note 6 zeros)

wtdcode avatar Mar 26 '23 05:03 wtdcode

This should be a non brainer, but do you know whether this address would work for POSIX on other architectures? (e.g. they might expect it to be higher than some other address, etc.) Anyway, it seems that we would need arch-specific profiles in the long run.

elicn avatar Apr 07 '23 14:04 elicn

This should be a non brainer, but do you know whether this address would work for POSIX on other architectures? (e.g. they might expect it to be higher than some other address, etc.) Anyway, it seems that we would need arch-specific profiles in the long run.

For straightforward solution, we also provide a (note: experimental!) 1:1 memory emulation mode. In other words, all virtual memory is available and mapping to exactly the same physical address and skip all possible MMU checks (including the kseg0 check mentioned above). It could be switched by: https://github.com/unicorn-engine/unicorn/blob/51a5b68b50ec41d6693544688bc419aa53b30821/bindings/python/unicorn/unicorn.py#L809

But anyway, we don't have recent plan to release a new version due to many backlogs (your python refactor, windows memory allocation fix etc) so there is still some time for figuring out this.

Note I test 0x1000000 works for Qiling tests.

wtdcode avatar Apr 08 '23 02:04 wtdcode